Privacy Policy & Data Processing Agreement

The Platform handles two kinds of data, and ASC's role differs for each:

Client Data may be submitted by the client's own personnel, by ASC staff on the client's behalf, or by a duly appointed REA or REM ("Appointee") acting under professional appointment. Regardless of who uploads it, Client Data is deemed provided by, and remains the responsibility of, the client organisation.

We process two categories of data: Personal Data (relating to identifiable individuals) and Client Data (building and energy information).

We do not collect sensitive personal data such as health records, biometric data, government-issued identification numbers, or financial account credentials, and the Platform has no fields for them. You must not upload such data to the Platform.

We process data solely for the following purposes:

• ✓Providing the Platform and its energy audit, ESM recommendation, bill verification, and reporting features
• ✓Extracting data from uploaded utility bills, spreadsheets, and documents so that it can be reviewed and saved by a user
• ✓Generating AI-assisted energy saving measure recommendations and draft audit report narratives
• ✓Calculating energy benchmarks (BEI/EUI) against MS 1525:2019 and SEDA requirements
• ✓Checking professional registrations at sign-up and monitoring certificate expiry, so that only eligible professionals verify Client Data
• ✓Running automated data-integrity checks on building records to support the accuracy of Client Data (see 4.1 below)
• ✓Receiving client documents through the optional shared intake folder, and issuing receipts and reminders for it
• ✓Sending operational emails: registration verification, approvals, reminders, digests, and support ticket updates
• ✓Maintaining platform security, including security event logging, performance monitoring, and error diagnostics
• ✓Responding to and tracking support requests from authorised users

4.1 Automated Processing Transparency

The Platform uses two distinct kinds of automated processing, and we distinguish them deliberately:

ASC engages the following sub-processors. Each is bound by written data processing terms consistent with this Policy. We will give clients at least 14 days' notice of any addition or replacement by updating this page and emailing the client's designated contact.

Transient processing by AI sub-processors involves transmission of specific data extracts for inference only; the Platform does not instruct those providers to store Client Data, and their handling of in-flight data is governed by their respective API terms. On our own systems, AI calls are logged as metadata only (feature, model, token counts, duration, and status), with no raw prompt or response content retained in those logs.

All Client Data and account data is stored at rest within AWS ap-southeast-1 (Singapore). Application functions that read or write that data run in Vercel's Singapore region and hold data in memory only for the duration of a request. No persistent storage of Client Data occurs outside Singapore.

The following processing takes place outside Malaysia, each under written data processing terms with the recipient:

• Singapore: persistent storage, application functions, and Qwen model inference
• United States: Claude model inference, transactional email delivery, and error diagnostics (identifiers removed)
• Microsoft 365: email and shared-folder content, in the data-centre geography assigned to ASC's Malaysian tenant

These transfers are made in accordance with section 129 of the PDPA: to jurisdictions whose law provides protection comparable to the PDPA, and with the consent of each user, which is recorded when the user accepts this Policy at registration. ASC does not transfer Client Data to any other jurisdiction without the client's prior written consent.

Upon written request following the end of an engagement, ASC will return, delete, or anonymise Client Data within 30 days and confirm completion in writing, except where:

• Retention is required by applicable Malaysian law (EECA 2024, PDPA)
• Data is held in our database provider's backup copies, which are overwritten on the provider's standard rotation
• Data forms part of aggregated, de-identified platform statistics that cannot be traced back to you

ASC implements the following technical and organisational measures, representing our current standard practice. Security measures are updated periodically and do not constitute a guarantee against all possible security incidents.

ASC maintains a documented personal data breach response procedure, owned by our Data Protection Officer, with defined roles, severity classification, and notification decision steps. Our commitments follow the PDPA breach notification regime introduced by the 2024 Amendment:

• Where ASC is the data controller (platform account data), ASC will notify the Personal Data Protection Commissioner as soon as practicable and in any event within 72 hours of becoming aware of a personal data breach, and will notify affected individuals without unnecessary delay, and in any event within 7 days, where the breach is likely to cause them significant harm.
• Where ASC is the data processor (Client Data), ASC will notify the affected client without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting that client's data, so that the client can meet its own obligations as data controller. ASC will cooperate with the client's assessment and any notification the client makes.

Notifications will include:

• Nature of the breach and the categories of data affected
• Estimated number of data subjects and records involved
• Likely consequences
• Measures taken or proposed to contain and remediate the breach
• Contact details of our Data Protection Officer

Incidents arising from the use of a client's or an Appointee's own credentials, or from their own actions, are investigated and handled in cooperation with the client.

Under Malaysia's Personal Data Protection Act 2010, as amended in 2024, you have the following rights with respect to your Personal Data:

Requests are handled under a documented procedure. We verify the identity of the requester before acting, and the Platform's audit trail (Section 8) allows us to identify what data we hold about you and how it has been processed. Requests concerning personal data contained in Client Data are referred to the client organisation as data controller, and we assist it in responding.

To exercise any of these rights, contact our Data Protection Officer at kentphang@atechnologies.com.my. We will acknowledge your request on receipt and respond within 21 days.

Platform Outputs fall into two categories, and users should understand the distinction:

• AI-generated content: document parsing suggestions, chat assistant responses, and draft ESM and report narrative text. These are drafts and suggestions only, are always subject to human verification before being saved or relied upon, and chat responses carry an in-product disclaimer. AI never writes directly to Client Data.
• Deterministic outputs: benchmark calculations (BEI/EUI), regression analyses, and data-integrity findings from the rules engine described in Section 4.1. These are produced by fixed formulas and rules, not AI models.

For transparency: our systems log AI usage as metadata only (feature, model, token counts, duration, and status). Raw prompt and response content is not retained in those logs.

The professional responsibility for all energy audit conclusions, certifications, and submissions to SEDA Malaysia or any regulatory authority rests solely with the appointed REA or REM and the client organisation. ASC accepts no liability for decisions made in reliance on Platform Outputs without independent professional verification.